go-microsoft-dm

go-microsoft-dm

Go packages for managing Windows 11 devices with the protocols Windows ships: Mobile Device Enrollment Protocol Version 2 (MS-MDE2, with MS-XCEP and MS-WSTEP), OMA Device Management 1.2.1 over SyncML (MS-MDM), the configuration service provider tree described by Microsoft's DDF v2 files, Windows Notification Services push, and Windows declared configuration. The repository also contains a reference server and an operator CLI. It does not provide an inventory UI or a fleet management product.

The root module contains protocol libraries, generated schema types, storage contracts and in-memory implementations. The server module adds SQL stores, the service layer, HTTP adapters and application wiring. Both modules require Go 1.27. The compliance target is Windows 11 version 26H2 on the shared 24H2 servicing branch (build 26100.x and later).

Status

Pre-alpha. Phases 0 to 7 of the implementation plan are done: the workspace, the pinned references, the foundation packages, the SyncML codec, the CSP schema generated from Microsoft's DDF v2 bundle, MS-MDE2 enrollment with the on-premises authentication policy, the MS-MDM management session engine (OMA DM packages 1 to 4, certificate and MD5 authentication, a monotonic command queue with per-command results, device- and user-scope gating, large-object chunking, unenrollment, and a software client that runs whole sessions against the engine), and a reference server (dmserver) with an operator CLI (dmctl) over persistent SQL storage. Native Windows 11 25H2 enrollment and management were validated in Phase 7. WNS push is implemented, while the linked Store identity currently cannot obtain a token for native delivery. The optional Windows agent wake workflow delivers queued commands through authenticated polling and a local OMA-DM trigger. The API is pre-1.0 and will change.

Running the reference server

dmserver is configured entirely from DM_* environment variables. The smallest run uses an in-memory store, an ephemeral self-signed CA, and accepts any enrollment credentials:

DM_STORE=memory DM_ENROLL_ALLOW_ANY=1 DM_BASE_URL=https://localhost:8443 \
  go -C server run ./cmd/dmserver

DM_STORE selects sqlite, postgres, mysql or memory; a real store also needs DM_DSN. Set DM_TLS_CERT and DM_TLS_KEY to terminate TLS, or front the server with a trusted proxy. The pure-Go build carries every SQL driver, so the container needs no system libraries:

docker build -t dmserver .

dmctl inspects and drives a store directly (same DM_STORE/DM_DSN): list enrollments, queue commands from a file, and read back results and events. Run go -C server run ./cmd/dmctl for its subcommands.

Layout

A package imports its own tier or lower; the library never imports the server module. The rule is enforced by internal/layout.

Development

make tools        # gotestsum, gofumpt, govulncheck, golangci-lint built with this module's Go
make verify       # the DDF bundle matches its manifest and schema/ matches regeneration
make generate     # regenerate schema/csp, schema/policy and schema/registry
make test         # both modules, race detector and coverage
make lint         # golangci-lint in both modules
make fuzz-smoke   # every fuzz target, briefly
make coverage     # 95% overall and per non-exempt package
make ci           # all of the above
make specs        # download and verify the pinned specifications (network)
make refs         # clone the read-only reference implementations (network)

Sources

The specifications, Microsoft Learn pages, reference implementations and community findings this project is built from are catalogued in docs/research.md; the revisions in force are pinned in decision record 0002.

License

MIT. See LICENSE. The Microsoft Open Specifications and OMA documents this project implements carry their publishers' own terms; see decision record 0001 for what they permit.